GHSA-9G4J-V8W5-7X42

Vulnerability from github – Published: 2025-07-22 14:31 – Updated: 2025-07-23 22:15
VLAI?
Summary
Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources
Details

Summary

Deactivated users that had either enrolled via OAuth/SAML or had their account connected to an OAuth/SAML account can still partially access authentik even if their account is deactivated. They end up in a half-authenticated state where they cannot access the API but crucially they can authorize applications if they know the URL of the application.

Patches

authentik 2025.4.4 and 2025.6.4 fix this issue.

Workarounds

Adding an expression policy to the user login stage on the respective authentication flow with the expression of

return request.context["pending_user"].is_active

This expression will only activate the user login stage when the user is active.

For more information

If you have any questions or comments about this advisory:

Severity ?
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "goauthentik.io"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20250722122105-7a4c6b9b50f8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-53942"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-22T14:31:12Z",
    "nvd_published_at": "2025-07-23T21:15:26Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nDeactivated users that had either enrolled via OAuth/SAML or had their account connected to an OAuth/SAML account can still partially access authentik even if their account is deactivated. They end up in a half-authenticated state where they cannot access the API but crucially they can authorize applications if they know the URL of the application.\n\n### Patches\n\nauthentik 2025.4.4 and 2025.6.4 fix this issue.\n\n### Workarounds\n\nAdding an expression policy to the user login stage on the respective authentication flow with the expression of\n\n```py\nreturn request.context[\"pending_user\"].is_active\n```\n\nThis expression will only activate the user login stage when the user is active.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Email us at [security@goauthentik.io](mailto:security@goauthentik.io).",
  "id": "GHSA-9g4j-v8w5-7x42",
  "modified": "2025-07-23T22:15:09Z",
  "published": "2025-07-22T14:31:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-9g4j-v8w5-7x42"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53942"
    },
    {
      "type": "WEB",
      "url": "https://github.com/goauthentik/authentik/commit/7a4c6b9b50f8b837133a7a1fd2cb9b7f18a145cd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/goauthentik/authentik/commit/c3629d12bfe3d32d3dc8f85c0ee1f087a55dde8f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/goauthentik/authentik/commit/ce3f9e3763c1778bf3a16b98c95d10f4091436ab"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/goauthentik/authentik"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.